15 ms·
Actively exploited sandbox RCE in all Chromium versions
- mellowbadger70 11d ago[flagged]
- petra303 12d agoOnly a score of 8.8?
- teravor 12d agoRCE inside sandbox, so requires chaining with another 0day.
- zahlman 12d agoWhat exactly does "RCE inside sandbox" describe that goes beyond "the webpage can supply arbitrary JavaScript and the JavaScript engine executes it", but is still isolated from the system?
- jnwatson 12d agoIt means it can execute arbitrary machine code in the sandbox.
- zahlman 12d agoOkay, and why is that more of a security risk than executing arbitrary JavaScript in the sandbox?
- p-e-w 12d agoIt can do some things that JS can’t do, such as invalid pointer writes. But you are correct that this doesn’t automatically imply system access.
- r_lee 12d agobecause with proper code exec you can trigger other bugs to escalate beyond the sandbox, whereas with JS you'd have to find a bug to escape from JS to native can't get a proper ios/Android RCE with just JS code exec
- insanitybit 12d agoBecause Javascript theoretically can't just access files on disk. Control over the render would let you do that, if not for the process level sandbox, which constraints things like file access, system, calls, etc. But the process is still more capable than the VM. The process can talk to other processes via IPC, for example. That's why you don't go from "javascript -> computer is taken over", instead you go from "javascript -> renderer control -> computer is taken over".
- arcfour 12d agoAmong other things, JavaScript in the browser has no way to even express "kill PID 1234 on the user's machine" or "list the contents of `C:\Users\Documents` and upload all of the files" or "spawn cmd.exe on the user's machine". How would you even do these things if you could run any JavaScript in the browser? You can't. However, chrome.exe itself does because it's a native application, as is the sandboxed JavaScript interpreter inside of chrome.exe. (This is a very oversimplified explanation but I think this is the disconnect people are having)
- bawolff 12d ago> JavaScript in the browser has no way to even express ... "list the contents of `C:\Users\Documents` and upload all of the files" this is besides the point, but javascript has the file system api. anyways to your broad point, i dont think this is convincing. What's the difference between not having an api vs having an api that is disabled (e.g. the syscall exists but is filtered). Either way you are not taking the action. RCE in the sandbox is an important step in the bigger exploit chain, but not because you can express things in the traditional syscalls inside the sandbox.
- zahlman 12d agoOkay, but we're still talking about running machine code inside the sandbox, where that functionality is still not available.
- arcfour 11d agoThe functionality is restricted, but the capability of expressing the intent at all exists.
- r_lee 12d agoI think people would like to understand what the "sandbox" is here and what isolation does it provide, is it an unprivileged process? something chromium specific? a v8/JS thing? etc.
- ranger_danger 12d agoSeems to use OS-specific kernel syscall filtering facilities. Windows: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/design/sandbox.md#The-integrity-levels https://chromium.googlesource.com/chromium/src/+/HEAD/docs/d... Linux: https://chromium.googlesource.com/chromium/src/+/0e94f26e8/docs/linux_sandboxing.md https://chromium.googlesource.com/chromium/src/+/0e94f26e8/d...
- r_lee 12d agogreat link, thanks
- Genwald 12d agoV8 also has its own sandbox, which I believe exists in that sandbox. I assume that's the one this exploit has RCE in, but its unclear. https://chromium.googlesource.com/v8/v8.git/+/refs/heads/main/src/sandbox/README.md https://chromium.googlesource.com/v8/v8.git/+/refs/heads/mai...
- insanitybit 12d agoI would assume in this case that there's full renderer control, not just a bypass of the in-process isolation.
- TacticalCoder 12d ago> It means it can execute arbitrary machine code in the sandbox. Well which is precisely why we have sandboxes. To me "executing arbitrary code in the sandbox" is similar to "I don't give a flying fuck for it's what a sandbox is for". More information is needed. As someone commented: this has to be paired with at least another exploit to make anything remotely useful. A sandbox is a sandbox. We want to understand how "code running in a sandbox" is "actively exploited".
- deleted 12d ago[deleted]
- johnsmith1840 12d agoMemory isolation having one tab or account open on your bank and another on this page does not mean it could leak across the sandbox and steal bank account details but anything inside of your general page content can be lost
- deleted 12d ago[deleted]
- jimrandomh 12d agoIt means it can execute native code inside the sandbox, as opposed to Javascript. While still sandboxed, this lets it access some parts of the attack surface that JS would not have been able to, some of which may have other exploits that allow escaping the rest of the way.
- StilesCrisis 12d agoChrome runs webpages in individual sandbox processes with very low privileges, as a defense-in-depth strategy. It generally requires at least two exploits to actually affect a user--first, get RCE in a sandboxed process, then find a separate vulnerability that lets you escape the sandbox process entirely. For this bug to have actually been used in the wild, there was almost certainly a second bug as well.
- iririririr 12d agowhat is online ad networks for $100, alex
- deleted 12d ago[deleted]
- jeremyjh 12d agoI don't know why this is being downvoted. This is called malvertising and its one of the most significant vectors for exploiting a vulnerability like this. Its happened multiple times over the last two decades. My read of Google's disclosure is that there is likely no known escape from the sandbox. I don't agree this would be reported this way just because "user action" like "using web browser" is required. Even if this individual CVE is correctly an 8.8 there would be a critical assessment of a known chain. The only reason there wouldn't be, would be if the other vulnerability is known to Google but has no patch yet.
- TZubiri 12d agoThis doesn't affect the score though, the reason there's 1.2 points less than the max is because there is a Required User Interaction. The user needs to visit a specific html page. Even with the sandbox protection layer, the rest of the parameters are maxed out.
- Cider9986 12d agoBrave is beating GrapheneOS on update timeliness: https://github.com/GrapheneOS/Vanadium/releases https://github.com/GrapheneOS/Vanadium/releases https://github.com/brave/brave-browser/releases https://github.com/brave/brave-browser/releases Only if you use Nightly wait maybe not.
- chuckadams 12d agoThe release version just now updated to 152.0.7977.83 which has the fix.
- fmajid 12d agoI upgraded Vivaldi, which is reporting 152.0.7977.112
- deleted 12d ago[deleted]
- anon109 12d agoIs graphene even affected? JIT is disabled in default configurations.
- drewfax 11d agoThat's how the system or browser should be configured. Secure by default and any insecurity must be an opt-in. But Google won't do it because their websites are JS heavy monster trucks and millions of websites run their tracking scripts which require JIT enabled by default for optimal page load.
- d2kx 12d agoThis issue is already fixed in Google Chrome (152.0.7977.83)
- azakai 12d agoTFA says > Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. So it was fixed in 152.0.7977.82 (before .83), if I read that right.
- Terr_ 12d agoAs somebody who prefers to browse with JS off whenever possible, there's something absurd about the balance everyone takes for granted between (A) your personal safety against a devastating hack by malicious code and (B) surveillance advertising. "Sorry, but to enter this shop you need to take one of the used syringes from that pile some dude delivers every day and poke yourself with it."
- TZubiri 12d agoThis seems irrelevant as the issue talks about being exploitable with a crafted HTML page, no mention of JS. If true, you would be able to be hit without js enabled.
- krackers 12d agoIt mentions a type confusion in V8. Is it possible to trigger that without JS enabled? The "all chromium versions" part of the title is also misleading, most browser CVEs do not distinguish between "untested lower bound" vs "affects all" (even though it seems like it'd be trivial to bisect).
- colincowardly 12d ago[dead]
- anonymousiam 12d agoJust one more reason to never use Chrome. Their removal of MV2 to prevent UBlock Origin from working is another.
- armadyl 12d agoThis is like saying never use seatbelts because people still die in car accidents. Chromium is still far superior on the security front than any other browser.
- lta 12d agoIf we needed any more.
- lima 12d agoWhich browser has a better security track record?
- Cider9986 12d agoVanadium makes improvements on Chromium. https://grapheneos.org/features#vanadium https://grapheneos.org/features#vanadium
- esseph 12d agoRight, but it's value-add on a derivative, not its own standalone engine.
- StilesCrisis 12d agoMost of those are just changing flags, not really unique development. Like "disable JIT" is a Chromium flag. "Zero-init everything" is a Clang flag.
- LiamPowell 12d agoIt's not even a build flag, it's a setting that you can just go and enable in Chrome's own settings menu (chrome://settings/content/v8).
- david_shaw 12d agoLet's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page (https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html https://chromereleases.googleblog.com/2026/09/stable-channel...), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? How much do you think an organization like Google would spend on, for example, AI tokens or compute to detect this internally before it was found and exploited in the wild? Ethical disclosure is a complicated topic, because researchers shouldn't hold bugs for ransom or demand high payment. But at the same time, if someone submits a critical issue like this, it makes sense to pay them what the bug's actually worth. Why should a researcher be effectively penalized for responsibly telling a vendor instead of selling the bug to a "research firm" or three-letter agency? It's one thing if you're an open source project maintainer just trying to put something out to the community. The math is a lot different if you're Google.
- zx8080 11d agoThis sends 2 clear signals: - for developers: don't report, it's not worth it - for users: Google does not care about security as it doesn't pay for reporting (enough).
- CookieCrisp 12d agoWhile I agree 1000 is hilariously low for this, worth is hard to quantify. Do you pay what it could theoretically cost your company? the amount the top bidding bad actor would be willing to pay?
- thenewnewguy 12d agoDoes anybody have a source for the "actively exploited" part of the HN title?
- esseph 12d ago"Google has confirmed that an exploit exists in the wild but has not disclosed information about the threat actors, targeted organizations, or attack campaigns while the update is still rolling out."
- john_strinlai 12d agoby nature of being in the "known exploited vulnerabilities catalog" (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85046 https://www.cisa.gov/known-exploited-vulnerabilities-catalog...) "CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild."
- crtasm 12d agoThis line, I think? >This CVE is in CISA's Known Exploited Vulnerabilities Catalog
- publlus_enigma 12d agoNormalising running arbitrary code delivered over the internet (in the form of JavaScript and WASM), as a necessary condition for accessing most web pages may not have been one of the best decisions we have made.
- eru 12d agoIn the future we can ask that your JaveScript and Wasm comes with a proof of being benign.
- valleyer 12d agoPrior art: the evil bit https://datatracker.ietf.org/doc/html/rfc3514 https://datatracker.ietf.org/doc/html/rfc3514
- muvlon 11d agoWhat would that even look like? What is "benign"? The browser environment already has pretty strict rules for what the JS can do. It's not allowed to read your files, see your webcam without permission, know about other tabs or windows etc. The problem here is that the browser failed to correctly implement those rules. If the chromium team cannot do that, what makes you think they can implement any other kind of "benign code" verification with zero bugs?
- eru 11d ago
- basilikum 12d agoFor what is this exploited in the wild when it doesn't include a sandbox escape? Is this chained with n-days?
- sebstefan 12d agoIf it's in the CISA known exploited vulnerabilities catalog, tell me if I'm wrong but I assume people don't go around exploiting million dollar 0-days in public just to fuck around safely in a chrome sandbox. So maybe we're going to see another CVE for the sandbox escape soon?
- daveguy 12d agoCrypto mining would be one application. But also, combined with a sandbox escape would make it particularly devastating. Usually full control of a device takes at least two exploits given the layers of security present in OS and browser environments.
- pizlonator 12d agoThere's a risk that someone had been sitting on a sandbox escape that assumed having RCE inside the sandbox first, and so they'd been waiting for an RCE exactly like this one. Those folks would not be disclosing their sandbox escape unless they were good guys. (Posted with a memory safe WebKit, Fil-C FTW)
- pizdocalmin 12d ago[flagged]
- oynqr 12d agoYou should add a disclaimer that you are the CEO of Fil-C. /s In the context of this vulnerability, I doubt memory safety would have made much of a difference. This is a great reminder though, currently doing a full userspace replacement on my 3D printer and Fil-C might be just what I need for the irreplaceable C parts.
- 11d ago
- throwatdem12311 12d agoI’m so tired. I think I’m just going to get a job as a garbage man and cancel my internet.
- tclancy 12d agoJust in time.
- jesse_dot_id 12d agoThere's been a Chrome CVE like every week ever since it came out.
- iammrpayments 12d agoThey just released a CVE for a garbage truck vulnerability where an attacker could brick the vehicle by exploiting the telemetry system these things now have preinstalled in factory.
- jdironman 12d agoSounds like much needed downtime for the person slinging the garbage then.
- Sha1rholder 12d agoDon't. Garbage Collector hurts your memory
- neogodless 11d agoSometimes you want nothing more than to make room for new memories.
- throwatdem12311 11d agoI kinda want to just forget things though.
- dgellow 11d agoGC doesn’t hurt, you just need to stop the world, do a cleanup, and you’re good to go :)
- TZubiri 12d agoWhy is this 8.8? It's because User Interaction is Required. CVSS 10 would be the case where everyone can be exploited without interaction. Interestingly the 8.8 is more alert-worthy than the 9.8 and 10 cvss, because there is a need to be alerted of the current security risk, whereas with a cvss 2 vuln, there is nothing to be done by users, only admins.
- snorbleck 12d agoSo basically, Edge, Brave and any other browser built on Chromium. Nice.
- anonymars 12d agoMonocultures are great!
- strenholme 12d agoThere’s a reason I use Firefox (Gecko). Also, Ladybird—another completely different web engine—is really promising. I spent five hours building it from source, having it take about 8 gigabytes of space, and it perfectly renders my own webpages and blogs. I have a feeling someone’s going to make an open source browser using Ladybird’s engine before Ladybird has official binaries.
- tkot 11d agoIs Firefox actually safer than Chromium-based browsers though? I know this is old: https://madaidans-insecurities.github.io/firefox-chromium.html#security-researcher-views https://madaidans-insecurities.github.io/firefox-chromium.ht... but has the situation changed substantially in favor of Firefox?
- armadyl 11d agoNo. The post applies to Android, but the situation is significantly worse on desktop platforms since Android at least has OS-level sandboxing, etc. https://www.reddit.com/r/GrapheneOS/comments/1unhtxu/initial_response_to_a_blog_post_claiming_to/ https://www.reddit.com/r/GrapheneOS/comments/1unhtxu/initial...
- strenholme 11d agoIt looks like more of Firefox has been ported over to Rust since then: https://www.wilderssecurity.com/threads/security-chromium-versus-firefox.450867/#post-3136787 https://www.wilderssecurity.com/threads/security-chromium-ve... The reason why I support Gecko and Ladybird’s engine is because I am opposed to monoculture, however. Even if Gecko (Firefox) is less secure than Chromium (Chrome, Edge, etc.), by not having a monoculture, a Chrome exploit will only take down the subset of people using the Chromium ecosystem, and not affect Gecko users. Alas, most people are in the Chromium ecosystem right now so that means malicious hackers only need to target one codebase. It’s the same reason I wrote MaraDNS back in 2001—back then, there was only one open source DNS server[1,2] so I wrote another one.[3] [1] Djbdns was around back then but wasn’t open source, which limited its adoption. [2] https://lwn.net/2001/0208/ https://lwn.net/2001/0208/ [2] MaraDNS was and is optimized for running at most a few dozen domains on a system running a bunch of other services, where one does not want the DNS server causing security problems for the server, and where the DNS server needs to be lightweight as possible.
- johnnyApplePRNG 12d agoNIST probably had this one filed and ready to announce years ago like those news agencies have obituaries of famous old people pre-written
- edoceo 12d agoI know a regular old geezer who's written his own obituary. Publish this when I die. I bet famous people have their people write one to distribute immediately. Also, writing those for your family sucks, easier to do it when they are alive and can tell some key stories.
- radium3d 12d agoDoesn't everyone else immediately update everything on their computer before they start doing anything?
- Invictus0 12d agowhat planet are you living on
- throawayonthe 11d agothat feels pretty table-stakes no?
- chrisjj 12d agoIs that frequent enough? I mean an update might be issued after you start doing something.
- mamzxcvbn779807 12d ago[dead]
- deleted 12d ago[deleted]
- jewsdienow 12d ago[dead]
- pizlonator 12d agoSounds wild. (Posted from memory safe WebKit; i.e. WebKit compiled with filcc and all of WebKit's dependencies compiled with filcc.)
- krackers 12d agoFor it to be memory safe, do you have to disable the JIT?
- pizlonator 12d agoYeah
- amluto 12d agoIt sounds technically possible to build a JIT where a verifier checks that the JIT-generated code is correctly pizlonated before allowing it to become executable. :)
- pizlonator 12d agoYes I have a new tech called SaRCAsm, which is a memory-safe assembler. So the next step is a "Sarcastic JIT" :-)
- Ohentis 12d agoI think it makes more sense to verify that the jit is correct than to verify that it's output is correct at runtime.
- pizlonator 12d agoNah It's damn near impossible to verify that the JIT is correct. But it is possible to verify at runtime that the code that the JIT emitted obeys some memory safety law. (V8's heap sandbox is an example of this; a sarcastic JIT would be an arguably stronger example of this.)
- jewsdienow 12d ago[flagged]
- DANmode 12d agoIt’s not. Same as credible threats are also seen as nothing to do with free speech. It just isn’t what free speech is. It’s a separate thing.
- fc417fc802 12d agoNo, it is a limit on free speech but it is one of several that various governments (and cultures as a whole) throughout the world have upheld fairly consistently. Free speech is more or less an unachievable platonic ideal that we aspire to. Success varies, as do the compromises made along the way. Speaking more generally, don't let your ideals bias your judgment. Just because you support policy X and also view ideal Y as good that doesn't mean that X isn't detrimental to Y. It's important to be objective about these things.
- DANmode 10d ago> Free speech is more or less an unachievable platonic ideal that we aspire to I’m almost certain it’s shorthand for “freedom of expression”, which most reasonable people throughout history have not grouped threats of violence into. In fact, they’ve done violence in return, historically, in response to credible threats, and some jurisdictions uphold that legal right. So, it truly has nothing to do with my ideals.
- fc417fc802 10d agoI'd counter that freedom of expression is either equivalent to or a superset of freedom of speech. The specifics are purely an argument of semantics and thus most likely uninteresting and not worthwhile. Most reasonable people throughout history have not attempted to defend any sort of blanket right to make threats of violence in any and all circumstances, I obviously agree with you there. My point was that this is clearly a restriction on the freedom to express oneself. I don't know how to articulate my reasoning here any further because the meaning is about as literal as you can get. A threat of violence is most certainly an expression made by an individual after all. It isn't always desirable or even possible to achieve a platonic ideal that we otherwise generally recognize as being good to strive for. However pretending that we aren't making carveouts leads to muddy thinking and paves the way for abuses.
- jewsdienow 12d ago[dead]
- Animats 12d agoChromium, or just Chrome?
- deleted 12d ago[deleted]
- vilas900420 12d ago[flagged]
- pertique 12d agoNot to downplay the severity (patch your browsers!), but there have been 5-10 actively-exploited V8 type confusion vulnerabilities in the last year. I'd be curious if this one blew up because it was the only one that was posted, or if it barely crossed some line in the collective consciousness this time around.
- RA2lover 12d agoI think it's the first one where the Chrome version fixing it has no Manifest V2 support at all.
- mikeweiss 12d agoIsn't this exactly why there is a sandbox? What can the RCE actually do or obtain within the sandbox?
- deleted 12d ago[deleted]
- socalgal2 12d agoYes, it says right in the CVE > allowed a remote attacker to execute arbitrary code *inside the sandbox*
- mikeweiss 11d agoSo then what's the big deal? If you had JavaScript turned off it would allow code to run in the sandbox anyway?
- nikanj 11d agoDoesn’t any <script> tag let you run arbitrary code inside a sandbox anyway?
- lima 11d agoInside the JS sandbox, not the browser's outer containment sandbox.
- b8 12d ago$1k for this vuln is laughable. If the researcher wrote an exploit as the nday exploit devs did and sold it in the gray market they would of got significantly more.
- roschdal 12d ago[flagged]
- turpentine 12d agoWhat does your vibe-coded-in-C browser do to mitigate this kind of exploit?
- roschdal 11d agoMy vibe-coded browser doesn't have a JIT JavaScript compiler. https://github.com/nordstjernen-web/northstar-browser/blob/main/docs/cve-2026-85046.md https://github.com/nordstjernen-web/northstar-browser/blob/m...
- Woodi 12d agostruct MessageBuffer { int msgType; union { char *name; int nameID; }; }; That finally convinced me getting data using functions (accessors, getters, setters) is a good thing, even in C :) Just all that unnecesary if's are so annoing and killing performance...
- jewsdienow 12d ago[dead]
- flippingheck 12d agoDoes that somehow also explain why many (most?) desktop users survive with just a browser? To be clear, I'm not saying it doesn't. I'm saying I don't understand.
- jewsdienow 12d ago[dead]
- gib444 12d agoThere's something funny about the site needing JavaScript to display anything
- jewsdienow 12d ago[dead]
- noduerme 12d agoJust outta curiosity because I can't find it at a cursory look - what exactly would be the type (coersion?) that would allow v8 to execute arbitrary code? Is this like something in post data to nodejs that terminates early and is able to run exec or something, like unto a sql injection?
- timschumi 12d agoThe Chromium issue is not public yet, so let's go with a very simple example. Let's say that you have a type confusion bug that (in terms of the interpreted language) allows you to use an Integer variable as an Array. That sounds nonsensical when just considering the high-level language, but your computer is going to need something to work with when running a script. For an Integer variable it will for example store the value, and for an Array it would store a pointer to a data area (and that area then contains values). Now, if the interpreter loses track of which type a certain variable is, then it will also not know whether to interpret the internal data as a plain value (arbitrarily chosen by the script/attacker) or a pointer to well-formed data (carefully chosen by the runtime). As an immediate step, letting the attacker use an address of their choosing for array operations would allow them to read and write arbitrary memory that is reachable with this form of addressing. I'm putting specific emphasis on "form of addressing" here, because the v8 authors have considered this possibility and put additional protections in place. Within the sandbox, "addresses" are limited to a size of 32 bits, and address within a dedicated 4 Gigabyte area that is specifically for interpreter data. Within that area you are not going to find a lot of critical data to affect outside operations, you'd have to find a way to escape that memory area first. The next part is going to be a bit hazy because it's been some time since I did Chromium exploitation, and getting code execution within the sandbox from data writes is itself not an easy task. Now, we have established that there is not a lot of terribly important data within the 4 GB area. The data managing the interpreter lives outside, and any JITed code will also live outside because it needs different access permissions. We only really get to play with Objects and their data. Objects handling executable code are rare, but there are a few that are at least adjacent. Last time I checked, WASM was one feasible choice where you get reasonably predictable results with custom data, as it included a pointer to actual executable code that represents the WASM program. Under the assumption that the WASM interpreter/compiler does its job correctly the full block of executable code will not be very interesting. However, any integer constant in the program will end up somewhere within the executable code, and that would give you enough controllable data to encode one or two arbitrary instructions and a relative jump to the next integer constant. To start execution at the first integer constant, we'd then just modify the Object data of the WASM program to slightly offset the entrypoint. And that's the short form of a possible (and likely outdated) way of getting semi-arbitrary code execution within the sandbox (as we are running as a WASM program, and therefore have all the usual syscall restrictions and other security features engaged).
- ruuda 12d ago> Type confusion in V8 Fortunately I disabled js by default. Unfortunately, it breaks about 30% of the web. Including nvd.nist.gov, which shows a completely blank page without js enabled, even though with js it’s just a simple page with only static content.
- internetter 12d ago> Unfortunately, it breaks about 30% of the web. Only 30?
- baobabKoodaa 12d agoPeople who disable JS are very likely to have delusions like this.
- ruuda 11d agoI think my subjective feeling is in that ballpark, yes. There are of course many sites that are more like web apps that require js, but those are relatively trusted, I added exceptions for them long ago. For sites that I visit for the first time, I think more than half still work to some extent. Maybe they are slightly broken, but at least I can read the page. I’d say around 20–30% of the web even gets _better_, because you don’t get ads or cookiewalls. But then there are also many sites that just remain a blank page, not even showing a message that js is required. (And as the sibling comment points out, recently Anubis is also becoming more common; maybe in recent months it’s closer to 40–50% unusable.) When I hit that, often I am reminded that I wasn’t that interested anyway, and I close the tab. So maybe it’s more than 30% that breaks, and a more accurate statement would be “of the sites where I ended up reading a page, I had to opt in to js about 30% of the time”.
- gib444 12d ago> Unfortunately, it breaks about 30% of the web Only 30%? In 2026? With CloudFlare and Anubis et al absolutely everywhere? Not to mention SPAs
- ruuda 11d ago
- theteapot 12d agoIs this known to be exploitable in any Electron apps, and specifically VSCode extensions?
- no-name-here 12d agoIs the HN title true that it affects all "all Chromium versions"? Per OP link, it only affects Chrome versions prior to .82; .82 was released as stable 2 days ago. [1] (HN title also does not match the original title, which is the CVE ID -- not particularly intuitive.) [1] https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html https://chromereleases.googleblog.com/2026/09/stable-channel...
- cubefox 11d ago"only"
- turpentine 11d agoUbuntu still considers 152.0.7977.64 stable.
- malinono 12d agoSandbox RCE again. Every "it's sandboxed so it's safe" pitch really means "we hope the sandbox holds." Not a security model, just a sentence.
- soiax 12d agoThe title is bad, it is not sandbox escape, it is "RCE inside the sandbox", so only RCE when sandbox is disabled.
- ajross 11d agoThis is missing the point. The whole point of a "sandbox" in the sense of defense in depth is precisely because it's expected that first-line security guarantees will be broken. Like, maybe V8 has a bug and you can write Javascript that fools it into running arbitrary binary code. But that's less dangerous, because the V8 engine runs in a process sandbox and doesn't have access to the rest of the browser state. Which is exactly what happened here, as it turns out. This isn't a breakout (or isn't alleged to be a breakout) to the broader OS, only to the sandbox environment.
- roschdal 12d agoCVE-2026-85046 and Northstar web browser: https://github.com/nordstjernen-web/northstar-browser/blob/main/docs/cve-2026-85046.md https://github.com/nordstjernen-web/northstar-browser/blob/m...
- iberator 12d agoGood antivirus should protect you from such attacks. Even zero day ones.
- neuroticnews25 12d agoI would guess it's now trivial for attackers to have an llm analyse every new commit to chromium repo linking to an issue that's 403 for security reasons, but maybe I'm missing something.
- notatoad 12d agoEqually trivial for Google to do the same thing. Is it trivial to do this in a way that exceeds googles own ability to detect flaws?
- neuroticnews25 12d agoWhat i meant is analyze fixes for already reported and fixed vulnerabilities before the updated version is pushed to users.
- throwaway27448 12d agoHell yea. Let's see some real leaks.
- nazmul_ai 12d ago[dead]
- claiir 11d agoAren’t all the big chrome vulnerabilities type confusion?
- jokoon 11d agoI prefer firefox, but doesn't firefox have a history of more similar exploits?
- dgellow 11d agoPretty sure every browser has that history
- odyssey7 11d agoIt’s really a shame that my engineering school requires me to use Google Chrome because their Honorlock browser extension[1] requires Google Chrome. You would think that an engineering school would be wiser than to require their students use a specific web browser that’s tied to a specific vendor. [1] https://app.honorlock.com/install/extension https://app.honorlock.com/install/extension
- turpentine 11d ago> You would think that an engineering school would be wiser... Schools are a business run by administrative staff who make purchasing decisions to solve business problems. Schools love to reduce billable teaching hours through online coursework, which invites academic dishonesty from students, and paying for honorlock is a way to achieve that reduction in expenditure, rather than paying tutors to supervise exams in person.
- cubefox 11d agoOtherwise known as a "zero-day exploit".
- odyssey7 11d agoHow many Heartbleeds[1] must software users and our national security interests endure before the industry treats memory safety as a best practice for systems with exposure to the Internet? The V8 vulnerability being exploited today, CVE-2026-85046, is listed in NVD under CWE-843, "Access of Resource Using Incompatible Type ('Type Confusion')."[2] On this class of vulnerabilities, MITRE explains: > When a memory buffer is accessed using the wrong type, it could read or write memory out of the bounds of the buffer Memory safety is specifically intended to prevent errors like these from becoming arbitrary out-of-bounds memory access and native code execution. Even type safety --- from the 1970s --- can prevent type confusion. The CISA and the NSA have called for the adoption of memory-safe languages.[3] We exercise poor engineering judgment and poor ethics, as an industry, when we continue to expose users to classes of wholly avoidable security weaknesses in Internet-facing software. [1] https://en.wikipedia.org/wiki/Heartbleed https://en.wikipedia.org/wiki/Heartbleed [2] https://cwe.mitre.org/data/definitions/843.html https://cwe.mitre.org/data/definitions/843.html [3] https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4223298/nsa-and-cisa-release-csi-highlighting-importance-of-memory-safe-languages-in-so/ https://www.nsa.gov/Press-Room/Press-Releases-Statements/Pre...
- no-name-here 11d ago[dead]
- dchest 11d agoThere's more to it than just using a memory safe language.
- deleted 11d ago[deleted]
- dundarious 11d agoType confusion bugs exist in Rust programs too, the language does not eliminate all such issues (though it does help somewhat). I think it would be more prudent to wait until we have details before getting on the soapbox.
- 11d ago
- keel-control 11d agoGoogle has the means and ability to rewrite Chromium ; bug for bug in Rust from C++ using Astra & Fable. Same for the Linux kernel. Considering the Fermat's Last Theorem lean proof was 13MLoC and cost $300,000 it would cost $2M to rewrite Chromium & Linux in Rust going purely of combined LoC.
- mccr8 11d agoWriting Chromium entirely in Rust wouldn't prevent a JIT bug like this.
- keel-control 11d agook for this CVE exactly it wouldn't have worked but the general pareto 80-20 rule stands regarding the rest of the memory safety vulns
- weberer 11d agoWhy don't you do it and post it here then?
- keel-control 11d agoI don't have $2M
- rietta 11d agoAnother type confusion vulnerability! Interesting.
- tkot 11d ago> Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) What's the difference between "executing arbitrary code inside the sandbox via a crafted HTML page" and running whatever is in the <script> tag?
- guipsp 11d agoIn the script tag you only have access to JS. This allows you to escape JS and have native code execution. It is still sandboxed by os-level primitives, but it is an escalation/first step in successful exploitation.
- tkot 10d agoI see, so there are certain things that arbitrary native code could try do (let's say, try to execute a certain syscall) that native code produced by the JIT compiler wouldn't normally be able to attempt?
- hnav 11d agoWhat do CVEs like this one mean for the likes of fly.io and cloudflare who use V8 for sandboxing 3p workloads? I guess they have some degree of KYC and some hardening outside the sandbox, but chaining this with a container escape running under a free tier account could pwn the host.
- Eridrus 11d agoYou can just ask ChatGPT these questions these days, but it was a fun read: fly.io depends on Firecracker microVMs, so you should be concerned if you're running untrusted code, but not concerned about other people interacting with you wrt v8. Cloudflare depends on v8 isolates, which depend on the trustworthiness of the v8 sandbox, which is a non-trivial hurdle, but not an insurmountable one for attackers with the resources to have a v8 bug in the first place.
- sans_souse 11d ago> just ask ChatGPT these questions these days, but it was a fun read I'd prefer they ask here. Just saying.
- shledery 11d ago[flagged]
- jimmydoe 11d agoI don't like this question, but why Google still open source Chrome as AI finding exploits so fast? I want Chrome stay open source, but why should I believe it's possible?
- vhiremath4 11d agoIt seems like the Chromium issue on their bugboard, which presumably would have the example HTML and vuln patch, is blocked from being viewed. Is this because making it public increases the risk of exploitation? https://issues.chromium.org/issues/542403045 https://issues.chromium.org/issues/542403045
- badabingfrlgl 11d agoNext time, sell it to me, I’ll pay $1001!